CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0897 – libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service
https://notcve.org/view.php?id=CVE-2022-0897
A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd). Se ha encontrado un fallo en el controlador nwfilter de libvirt. • https://bugzilla.redhat.com/show_bug.cgi?id=2063883 https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html https://security.gentoo.org/glsa/202210-06 https://access.redhat.com/security/cve/CVE-2022-0897 • CWE-667: Improper Locking •
CVSS: 6.0EPSS: 0%CPEs: 6EXPL: 1CVE-2022-0718 – python-oslo-utils: incorrect password masking in debug output
https://notcve.org/view.php?id=CVE-2022-0718
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext. Se ha encontrado un fallo en python-oslo-utils. Debido a un análisis inapropiado, las contraseñas con comillas dobles ( " ) causan un enmascaramiento incorrecto en los registros de depuración, causando que cualquier parte de la contraseña después de las comillas dobles sea texto plano • https://access.redhat.com/security/cve/CVE-2022-0718 https://bugs.launchpad.net/oslo.utils/+bug/1949623 https://bugzilla.redhat.com/show_bug.cgi?id=2056850 https://lists.debian.org/debian-lts-announce/2022/09/msg00015.html https://opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e702426aa https://security-tracker.debian.org/tracker/CVE-2022-0718 • CWE-522: Insufficiently Protected Credentials CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-4180 – openstack-tripleo-heat-templates: data leak of internal URL through keystone_authtoken
https://notcve.org/view.php?id=CVE-2021-4180
An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. This flaw affects openstack-tripleo-heat-templates versions prior to 11.6.1. Un fallo de exposición de información en openstack-tripleo-heat-templates permite a un usuario externo detectar la IP interna o el nombre de host. • https://bugzilla.redhat.com/show_bug.cgi?id=2035793 https://access.redhat.com/security/cve/CVE-2021-4180 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2022-0996 – 389-ds-base: expired password was still allowed to access the database
https://notcve.org/view.php?id=CVE-2022-0996
A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. Se encontró una vulnerabilidad en 389 Directory Server que permite que las contraseñas caducadas accedan a la base de datos para causar una autenticación inapropiada A vulnerability was found in the 389 Directory Server. This issue allows expired passwords to access the database, causing improper authentication. • https://bugzilla.redhat.com/show_bug.cgi?id=2064769 https://github.com/ByteHackr/389-ds-base https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QFD7CBBX3IZOSHEWL2EYKRLOEQSXCZ6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYT2IQJFHQWZENJJRY6EJB3XIFZGNT7F https://access.redhat.com/security/cve/CVE-2022-0996 • CWE-287: Improper Authentication •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3589
https://notcve.org/view.php?id=CVE-2021-3589
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se ha encontrado un fallo de autorización en Foreman Ansible. Un atacante autenticado con determinados permisos para crear y ejecutar trabajos de Ansible puede acceder a hosts mediante plantillas de trabajo. • https://access.redhat.com/security/cve/CVE-2021-3589 https://bugzilla.redhat.com/show_bug.cgi?id=1969265 • CWE-306: Missing Authentication for Critical Function •